PRIVACY — 7 SEPTEMBER 2026

Your records live on your own device. Signing in syncs them to your own account. The app counts which features get used — never what your records say. Once you have agreed at the door, the Meta Pixel measures whether an advertisement brought you here — three named actions, never a record. Nothing is sold or rented, and nothing about your records ever reaches Meta.

If you write to us, your message and your address are kept so we can answer you.

An estate does not gossip.

Majordomo, at majordomocal.com, is operated by the operator of majordomocal.com — an individual based in Israel — who is the controller of every piece of data this page describes. Write to majorcal@majordomocal.com for anything on this page: to ask what is held about you, to get a copy of it, to have it deleted, or to withdraw a consent you gave.

The public pages at majordomocal.com — the landing page, the contact page and these documents — set no cookies of their own. Visits are counted in aggregate by Vercel Web Analytics, which sets no cookies and stores no personal data. The one form on them is the contact form, described under “Writing to us” below; nothing else on these pages asks you for anything.

The one third party that can learn of a visit is Meta, through the Meta Pixel described below — and only after you have accepted at the app’s door. Nothing from Meta loads before that, on the landing page included, so a visit that never reaches the door is never reported to Meta.

What you enter in the app — shifts, workouts, study, projects, money — is stored locally in your browser, on your own device. If you never sign in, none of it ever reaches us. The one-file export in Settings is yours to keep wherever you choose.

Signing in with Google is optional; it exists so your devices can share one estate. If you sign in, we hold your email address and Google account identifier, and your synced records, stored with our database provider (Supabase). Sync carries your records and a few display preferences; it does not carry this device’s consent or analytics settings.

After you agree at the door, the app sends anonymous usage counts to PostHog, hosted in the European Union: named events such as “a workout was logged” or “the Ledger was opened”, with a random device identifier, a session identifier, the time and, when an advertisement brought you here, the campaign label on that link — a name for the advertisement, never anything about you. Never the contents — no amounts, no titles, no notes, no body stats, no health numbers, no record text of any kind.

The identifier and any unsent counts live in your browser’s storage and are created only after you agree. If you sign in, the random identifier is linked to your account identifier so your own devices count as one person; your email address is not sent. You can switch analytics off at any time in Settings, under THE FINE PRINT — the “Share usage counts” switch, which also stops the Meta Pixel — and the app honors your browser’s Global Privacy Control signal automatically.

These counts exist to show which parts of the app are used and kept. They are not shared, sold, or joined to anything else.

Majordomo advertises on Instagram and Facebook. To learn whether those advertisements work, the site uses the Meta Pixel, a measurement tool operated by Meta Platforms, Inc. (Meta Platforms Ireland Limited for people in the European Economic Area, the United Kingdom and Switzerland). Its purpose is advertising measurement and attribution — telling Meta that a person who was shown an advertisement went on to arrive here, press GET STARTED, or finish the first-time setup — and nothing else.

It loads only after you press AGREE & ENTER at the app’s door, and never before. Until you have accepted, no Meta script runs and no Meta cookie is set — on the landing page as much as in the app.

Once it is running, the pixel reports three named actions — arriving on the landing page, pressing GET STARTED, and finishing the first-time setup — together with what any web request carries: your IP address, your browser and device details, the page address and the site you came from. It stores a random identifier in a cookie on this site so that it can recognise the same browser again. If you use Facebook or Instagram, Meta can connect those reports to your account there and combine them with what it already knows about you. We never send Meta your name, email address, phone number, or account identifier, and Meta’s “automatic advanced matching” is switched off.

Those reports go to Meta’s servers in the United States. That is a transfer of your data out of Israel and out of the European Economic Area, and by accepting at the door you consent to it. What Meta does with the data from there, and for how long, is governed by Meta’s own privacy policy.

Your browser’s Global Privacy Control signal is honoured and suppresses the pixel outright: with the signal raised, it does not load at all, whatever you accepted at the door.

Refusing changes nothing in the app except this measurement. No feature is withheld, nothing else changes, and you are not asked again. You can withdraw at any time in Settings, under THE FINE PRINT: turning off “Share usage counts” stops the Meta Pixel and the usage counts together, from that moment on. What Meta was sent before that stays with Meta, under its policy.

The contact page at majordomocal.com/contact, and the same form inside the app under Settings, send us a message. We keep what you write, the address you gave, the subject you chose, and the time — so that we can answer you and so that a later exchange about the same matter makes sense. You are given a short reference, and a copy of the receipt goes to your address.

If you send it from inside the app while signed in, the address used is your account’s own rather than one typed into a box, and you may choose to enclose facts about your device and the version you are running — your browser, screen size, time zone, which preset and wings are in use, whether you are signed in and synced, how much space your records occupy and how many of each kind there are. That list is shown to you before you send, and it never includes anything a record says.

Each message is read once by an automated assistant provided by Anthropic (United States), which classifies it — how urgent it is, whether it needs a person — and drafts a reply for us to edit. Anthropic does not use it to train models and deletes it within thirty days. Replies and receipts are delivered by Resend (United States). Nobody else sees it.

None of this is required of you. The mailbox below reaches the same person, and a message sent to it is treated exactly the same way — including a request to have your records deleted, which is honoured whichever route it arrives by.

Supabase holds accounts and synced records. PostHog (EU) holds the usage counts. Meta Platforms (United States) receives the advertising measurements described above. Anthropic (United States) sorts messages sent to us, and Resend (United States) delivers the email either way. Vercel hosts the app and takes the aggregate page counts. Google provides sign-in.

Market prices and exchange rates (Twelve Data, Frankfurter) are fetched directly from your device — for Twelve Data, with your own API key — so those requests travel from you to them under their policies, and we never see them.

Local records stay until you delete them, or your browser does. Synced records stay until you ask: write to majorcal@majordomocal.com from the address you signed in with, and whatever the sync holds is deleted — without argument and without a retention offer. Usage counts are pseudonymous and kept only while they are useful for understanding how the app is used.

Messages you send us are kept while the matter is open, and for a while after it closes so that a follow-up can be understood. Ask and yours are deleted, along with the address you sent them from: write to majorcal@majordomocal.com, or use the contact page.

What the Meta Pixel reported is held by Meta, not by us, under Meta’s own retention rules. Meta’s privacy policy explains how to review and clear it — “your activity off Meta technologies”, in your Facebook or Instagram settings.

No selling or renting of data. No advertisements inside the app. No advertising tool anywhere on the site beyond the single Meta Pixel described above, and none of it ever sees your records. No profiling of you by us, for anyone’s benefit. The app asks for no device permission it does not need.

Majordomo is not for children under 16, and we do not knowingly hold their data. If you believe someone under 16 is using it, write to majorcal@majordomocal.com.

If this policy changes materially, the app shows its door again and asks you to re-accept before continuing; this page always carries the current version, with its date below.

This version, of 7 September 2026, added the “Writing to us” section: the site now has a contact form, and what it keeps, who reads it and who delivers the reply are all named. The version it replaced, of 5 September 2026, described the site before there was any way to write to it from the page, and stays readable, word for word, at majordomocal.com/privacy/2026-09-05. The one before that, of 31 August 2026, is at majordomocal.com/privacy/2026-08-31.

Questions, requests, and anything this page did not answer: majorcal@majordomocal.com, or the form at majordomocal.com/contact.